CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread

A fresh CitrixBleed-class flaw in NetScaler headlines the day, with watchTowr disclosing the SAML pre-auth memory overread it flagged to Citrix back in March. Elsewhere, a China-linked USB implant sat inside Japanese military networks for nearly a year, a European defense spear-phishing operation was caught abusing AWS Cognito for credential-less C2, and Raphael Mudge’s open evasion tradecraft framework got a major push.

Vulnerabilities & Exploits

• Citrix patched six NetScaler ADC/Gateway flaws, led by CVE-2026-8451 (CVSS 8.8), a pre-auth memory overread in SAML IdP handling that leaks memory and can crash appliances — the latest entry in the “CitrixBleed” lineage. watchTowr Labs, which reported it in March, published its analysis and hinted more is coming. The Hacker News, watchTowr
• CISA confirmed ransomware crews are now exploiting BlueHammer (CVE-2026-33825), a Microsoft Defender privilege-escalation bug previously abused as a zero-day before patches shipped. BleepingComputer, SecurityWeek
• Langflow RCE (CVE-2026-33017, CVSS 9.3) is under active exploitation, with attackers scanning exposed AI-app endpoints to drop a Monero miner via a single unauthenticated POST. The Hacker News, Dark Web Informer
• Six flaws in AirDrop and Quick Share let a nearby attacker with just a laptop crash the sharing service on a Mac or iPhone (set to “everyone”) with no prompt, plus bypass validation checks. The Hacker News
• An audit of OpenReception, an end-to-end-encrypted appointment-booking platform, surfaced 16 post-1.0 CVEs including critical authorization-based privilege escalation and data exposure — the crypto held up, the app logic did not. moltenbit

Cloud & Identity

• Nextron tracked a threat actor running five concurrent spear-phishing campaigns against European defense and UAV supply-chain targets, all sharing one trick: AWS Cognito unauthenticated identity pools. Payloads (C#, Python, HTA) fetch fresh 15-minute STS credentials at runtime — no static keys to burn — and exfiltrate to attacker S3 buckets signed with hand-rolled SigV4. IOCs and detection rules published. Nextron (X)
• A clear write-up on FOCI (Family of Client IDs token exchange) and BroCI (broker-client) abuse in Entra ID explains how delegated permissions and broker apps with registered redirect URIs can obtain tokens and, in some setups, sidestep Conditional Access. sapirxfed
• Huntress revisited device-code phishing, dissecting the variations attackers favor and the “buy-the-tool-skip-the-setup” gaps that keep making it work. Huntress (X)

Threat Activity

• Leaked documents show Japan’s Ground Self-Defense Force used counterfeit, malware-laced USB drives — linked to Chinese operations — on machines connected to sensitive military networks for nearly a year. The drives entered via disaster-relief logistics after the January 2024 earthquake, bypassing standard procurement vetting. Bitdefender/NCSC-FI
• ToddyCat’s new Umbrij tool hijacks Gmail sessions by DLL-sideloading a headless Chromium instance and using remote debugging to steal OAuth codes; Kaspersky flags suspicious DLL loads and Chromium launch parameters for detection. Securelist
• UNC1151 (Ghostwriter) is running targeted Gmail phishing lures themed around “suspicious account activity,” with public domain-hunting and campaign analysis available. resident.ngo / Censys
• Kimsuky’s KimJongRAT checks whether Windows Defender is running and branches its execution path accordingly. blackorbird (X)
• RustDuck, a two-stage (Loader + Core) botnet rebuilt in Rust, is hijacking routers, IP cameras, Android boxes and weakly secured servers for cross-platform DDoS; QiAnXin XLab has tracked its rapid evolution since February. The Hacker News, XLab
• SimpleHelp CVE-2026-48558 (CVSS 10.0) intrusions are now dropping a second, previously unreported malware family — TaskWeaver — alongside Djinn Stealer, with the actor focused on credentials, SSH keys, crypto wallets and dev tooling. The Hacker News
• A “Boss Scam” chain abuses DLL sideloading to hijack WhatsApp Web sessions and impersonate executives for enterprise fraud. Ministry of Cyber Affairs
• Trojanized Pyrogram forks on PyPI, active since November, give attackers arbitrary file read on servers running Telegram bots. BleepingComputer
• A fake Perplexity extension on the Chrome Web Store intercepted searches and keystrokes, while McAfee’s “Silent Swap” clipper used a bogus Google Notes extension to swap crypto wallet addresses at transaction time. BleepingComputer, The Hacker News

AI & Model Security

• Microsoft IR research shows how a single poisoned MCP tool description can steer an agent into quietly exfiltrating company data without ever “breaking a rule” — every step looks routine, so default setups raise no alarm. Separately, Wiz detailed an Amazon Q VS Code extension flaw that auto-loaded workspace MCP configs without consent, enabling code execution and cloud-credential theft on opening a malicious repo (fixed in language server 1.65.0). The Hacker News, Wiz
• Adversa AI’s GuardFall bypass walks past AI coding-agent safety checks using decades-old shell-injection tricks, working against 10 of 11 open-source coding/computer-use agents tested (only “Continue” resisted). Dark Reading covers the related “Agentjacking” fake-bug-report technique. The Hacker News, Dark Reading
• LayerX’s BioShocking prompt-injection technique convinces AI browsers they’re in a fictional game and gets them to hand over user credentials — successful against six assistants including ChatGPT Atlas, Perplexity Comet, and Claude’s browser extension. BleepingComputer, The Hacker News
• A study of 444 iOS AI chatbot apps found 282 exposing paid model access in network traffic — plaintext API keys, reusable tokens, or open backends accepting keyless requests. The Hacker News
• vx-underground argues the AI boom is inverting malware-dev philosophy: instead of minimalist, position-independent binaries, attackers now deliberately stack dependencies and mix languages (Lua, Node SEA/nexe, Java, Python) with heavy multi-staging to defeat static analysis and emulation. vx-underground (X)

New Tools & Releases

• Tradecraft Garden and Crystal Palace — Cobalt Strike creator Raphael Mudge is publishing his evasion tradecraft openly: Crystal Palace is a linker for position-independent code with binary transformation, register randomization, link-time hooking and YARA generation from invariant instructions, feeding a PICO module convention used by Kits for Cobalt Strike, Sliver, Mythic and Adaptix. Required reading for red team and detection engineering alike. Tradecraft Garden, aff-wg.org
• ADWSHound — new AD enumeration tool operating over Active Directory Web Services, paired with a purple-team detection playbook. GitHub, detection guide
• ExploitGym — a large-scale, Apache-2.0 benchmark of 869 real-world vulnerability instances (programs, kernels, engines) for measuring AI agents’ exploit-development ability. GitHub
• SpotifyC2 — proof-of-concept covert C2 that retrieves commands from public Spotify playlist titles and returns output via Telegram, with no Spotify Web API. Novelty over utility, but a clean example of living-off-legit-services C2. GitHub
• Kali Linux 2026.2 shipped with 9 new tools, GNOME 50 / KDE Plasma 6.6, the switch to sources.list.d, faster VM boot, and NetHunter updates. BleepingComputer
• A write-up on PEB corruption demonstrates remote process termination by overwriting the Process Environment Block with invalid data via WriteProcessMemory. Medium

AI Industry

• Anthropic shipped Claude Sonnet 5, edging past Opus 4.8 on the GDPval-AA v2 knowledge-work test; a new tokenizer makes it ~1.4x costlier for English text. Anthropic pointedly noted it scores well below its export-restricted models on cybersecurity tasks. The Decoder, Simon Willison
• The Department of Commerce lifted export controls on Claude Fable 5 and Mythos 5; Anthropic will begin restoring access, with roughly 100 approved entities cleared to use Mythos 5 for cybersecurity work. BleepingComputer
• China’s efficiency push continues: Meituan’s LongCat-2.0 trained a 1.6T-parameter model entirely on Chinese chips, and DeepSeek’s DSpark framework claims 60–85% per-user speed gains — both aimed at reducing Nvidia dependence under tightening controls. The Decoder, The Decoder
• Anthropic launched Claude Science, a research workbench with 60+ preconfigured skills (genomics, computational chemistry), a citation/calculation verification agent, and local/HPC deployment so sensitive data stays in-lab. MIT Technology Review

Industry & Policy

• Microsoft is accelerating its quantum-safe cryptography roadmap, saying advances in quantum computing are pulling the timeline to replace current encryption standards forward. BleepingComputer